---
id: "CMP-202611-te5vs3"
page: "https://infrastack.ai/live/CMP-202611-te5vs3"
kind: "campaign"
aliases: []
title: "China-linked SilentAir spies plant backdoors in telecom networks, using SS7 and Diameter commands to track phones and intercept calls and SMS, mostly in Taiwan (ENEA)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "SS7", "fixed": []}, {"name": "Diameter", "fixed": []}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-13T09:01:34+00:00"
updated_at: "2026-11-13T09:01:55+00:00"
sources: [{"source": "analyst", "url": "https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/", "first_seen_at": "2026-11-13T09:01:34+00:00", "cites": ["https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/"]}]
exploit_sources: []
---

# China-linked SilentAir spies plant backdoors in telecom networks, using SS7 and Diameter commands to track phones and intercept calls and SMS, mostly in Taiwan (ENEA)

Link for people: https://infrastack.ai/live/CMP-202611-te5vs3 (this .md is for agents)

Telecom security firm ENEA reports SilentAir, a Chinese cyber-espionage group active since at least early 2025, has backdoored telco networks in six countries, mostly Taiwan. The backdoors send malicious SS7 and Diameter signalling commands to collect device data, track subscriber locations and intercept calls and SMS; in rare cases it targeted VIPs such as political figures and government officials. ENEA links it to Liminal Panda (cooperation not confirmed). Activity described as ongoing. The affected telcos are not named, and no indicators were published in the coverage (reported via Risky Bulletin, 13 Nov 2026).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :SS7 affected range not listed fixed no fixed version listed
- :Diameter affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says SilentAir backdoored telco networks and sent malicious SS7 and Diameter commands to track subscribers and intercept calls and SMS, but it does not say how the attacker got into those networks.

How it reached others: customers' data or keys went with it (third-party-breach).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#third-party-breach

## How to check

Telcos: review SS7/Diameter signalling for location-tracking and SMS/call interception requests from unexpected sources and look for backdoors on core-network signalling nodes. Specific indicators: unknown (none in the coverage; check ENEA's report). Organizations with staff in Taiwan: assume SMS and voice can be intercepted.

## Fix

Telcos: apply SS7/Diameter signalling firewall filtering and hunt for implants on core-network hosts. Everyone: do not rely on SMS for one-time codes or sensitive talk for high-risk staff (officials, executives, travellers to Taiwan); use app-based or passkey MFA and end-to-end encrypted messaging.

## Timeline

- 2026-11-13T09:01:34+00:00 analyst https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/

## Documents

- [describes] @campuscodi.risky.biz: -Chinese APT uses SS7, Diameter attacks to spy on targets
-Cyberattack takes dow https://bsky.app/profile/campuscodi.risky.biz/post/3n26lk2jlbs2l
- [describes] Risky Bulletin: Chinese APT uses SS7, Diameter attacks to spy on targets https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_